Coding agent permission checks are scattered, and model output is equivalent to full host privileges
Understand this story
A 2026 study by Nankai University and Tsinghua University tested Claude Code, Codex CLI, and Gemini CLI, concluding that these coding agents' access checks are scattered inside individual tools rather than uniformly intercepted at the system layer. The study says write requests rejected by file tools can still be completed through the shell, and model output actually executes with the full privileges of the host user, effectively equivalent to running at ring 0. This means the agent's security boundary depends on each individual tool's own checks, and once another tool or channel is used, the restrictions may be bypassed.
AI overview based on source reports · Updated 1 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIThe Missing Ring-0 Protections for AI Agents
This essay argues that coding agents such as Claude Code, Codex CLI and Gemini CLI act with the developer's authority while access checks sit in individual tools, so a write refused by the file tool can go through the shell, and it proposes a deterministic commit-boundary supervisor that stages file, git, network and credential effects before policy approval. It reviews existing external enforcement (CaMeL, FIDES, CXI, Concordat) and sets out an unrun study with four hypotheses testing whether staged effects plus Commit Boundary add anything over those systems. Nothing described has been built, and the author states Commit Boundary is an unvalidated conceptual architecture.
Activity for this story
Not enough continuous observations to show a trend yet.